Opendistro_security.nodes_dn configuration error

Security
1

Greetings,

I’m currently getting the error:

[2019-06-17T12:13:54,589][ERROR][c.a.o.s.t.OpenDistroSecurityRequestHandler] [watcher_varmint] ElasticsearchException[Illegal parameter in http or transport request found.
This means that one node is trying to connect to another with 
a non-node certificate (no OID or opendistro_security.nodes_dn incorrect configured) or that someone 
is spoofing requests. Check your TLS certificate setup as described in documentation]

my nodes_dn config on both nodes is:

opendistro_security.nodes_dn:
  - "CN=varmint.my.company.com,OU=MC,O=My Company,L=Seattle,C=US"
  - "CN=notvarmint.my.company.com,OU=MC,O=My Company,L=Seattle,C=US"

*names have been changed to protect the innocent.

I’ve tried the config with no quotes, single quotes, double quotes and continue to get the error. The certs are issued by commodo and I can verify the cert chains and ssl keys every which way. I use them as SSL certs for a web server with no issue, but I can not get my nodes to talk.

Any ideas would be much appreciated.

2

I had the same problem, and ended up having just the CN=<hostname(s)> statement in nodes_dn. Not the optimal solution, but it works. They all need to be signed and you need the correct root CA.

3

@leifyt when you view your certificate, does it include the below:

X509v3 Extended Key Usage: critical
                TLS Web Server Authentication

and
Subject: C=US, L=Seattle, O=My Company, OU=MC, CN=varmint.my.company.com

and

X509v3 Subject Alternative Name: 
                Registered ID:1.2.3.4.5.5